{% comment %}
  Fixed red badge that hangs off the top center of the page. Two trigger
  conditions (see ``security_mode_banner`` in core_tags.py):

  * mode="unsafe"        — server is in a non-subdomain SERVER_SECURITY_MODE.
                           Archived content shares an origin with the admin UI.
  * mode="unconfigured"  — BASE_URL is not set. Always shown until the
                           operator pins it explicitly, even when CSRF
                           auto-derive or request-host fallback are keeping
                           the server functional.
{% endcomment %}
{% if mode == "unsafe" %}
<div id="archivebox-security-banner" role="alert" aria-live="polite"
     style="position:fixed;top:-10px;left:50%;transform:translateX(-50%);
            z-index:2147483647;background:#aa1e55;color:#fff;
            font:600 11px/1.3 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Arial,sans-serif;
            padding:14px 14px 4px 14px;border-radius:0 0 6px 6px;
            box-shadow:0 2px 10px rgba(0,0,0,0.35);pointer-events:auto;
            white-space:nowrap;letter-spacing:0.3px;text-transform:uppercase;">
  <span style="display:inline-block;background:#fff;color:#aa1e55;
               border-radius:3px;padding:1px 5px;margin-right:6px;font-weight:800;">
    ⚠ unsafe
  </span>
  ArchiveBox single-domain mode &mdash; archived pages share an origin with this site
  <a href="https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Modes"
     target="_blank" rel="noopener noreferrer"
     style="color:#fff;text-decoration:underline;margin-left:6px;">why?</a>
</div>
{% elif mode == "unconfigured" %}
<div id="archivebox-security-banner" role="alert" aria-live="polite"
     style="position:fixed;top:-10px;left:50%;transform:translateX(-50%);
            z-index:2147483647;background:#dc2626;color:#fff;
            font:600 11px/1.3 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Arial,sans-serif;
            padding:14px 14px 4px 14px;border-radius:0 0 6px 6px;
            box-shadow:0 2px 10px rgba(0,0,0,0.35);pointer-events:auto;
            max-width:90vw;letter-spacing:0.3px;text-transform:uppercase;">
  <span style="display:inline-block;background:#fff;color:#dc2626;
               border-radius:3px;padding:1px 5px;margin-right:6px;font-weight:800;">
    ⚠ base_url not set
  </span>
  To prevent unauthorized requests, you must set your intended server URL in env or config:
  <code style="background:#000;color:#fff;padding:1px 6px;border-radius:3px;font:700 11px/1.3 ui-monospace,Menlo,Consolas,monospace;text-transform:none;">
    BASE_URL={% if suggested_base_url %}{{ suggested_base_url }}{% else %}http://*.archivebox.localhost:8000{% endif %}
  </code>
  {% if machine_admin_url %}
    <a href="{{ machine_admin_url }}#BASE_URL"
       style="display:inline-block;background:#fff;color:#dc2626;padding:1px 6px;border-radius:3px;
              font-weight:800;text-decoration:none;margin-left:6px;text-transform:uppercase;">
      pin via admin →
    </a>
  {% endif %}
  <a href="https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Modes#base_url"
     target="_blank" rel="noopener noreferrer"
     style="color:#fff;text-decoration:underline;margin-left:6px;">docs</a>
</div>
{% endif %}